CyberSecBulletin
CVE-2026-52946NVD status: Modified

Linux: Improper Locking

Published Updated By the CyberSecBulletin desk

CVE-2026-52946 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 54626335ea4174ab2d9a183b511d825f6765e47b, 897d6a7247739fb1528f98c575df4f2e5de7f994, 32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.47% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 54626335ea4174ab2d9a183b511d825f6765e47b or 897d6a7247739fb1528f98c575df4f2e5de7f994 or 32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33 or b5fa9e32fb6718f70c986ee14dd5d01b4846f331, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 54626335ea4174ab2d9a183b511d825f6765e47b; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 897d6a7247739fb1528f98c575df4f2e5de7f994; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, b5fa9e32fb6718f70c986ee14dd5d01b4846f331; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 1bee417678f1135e35b25a37734db46aa94258d2; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 20a93e397abe850c49b6fa0e8cc827b5f634a8f5; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, bfcc8e8d8a495bb34cae9e620adfb75fb13a3954; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 36c1b57b2ecf3c61ac93f5f07bd29b6f21e226ed; and 2 more ranges54626335ea4174ab2d9a183b511d825f6765e47b, 897d6a7247739fb1528f98c575df4f2e5de7f994, 32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33, b5fa9e32fb6718f70c986ee14dd5d01b4846f331, 1bee417678f1135e35b25a37734db46aa94258d2, 20a93e397abe850c49b6fa0e8cc827b5f634a8f5
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)V3.1.6 and later; V3.1.7 and laterNot stated
LinuxLinux Kernel2.6.12.1 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.94; 6.13 up to, but not including, 6.18.36; 6.19 up to, but not including, 7.0.13; 7.1 up to, but not including, 7.1.1; and 1 more ranges5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in send_sigio() and send_sigurg() when a process group receives a signal. When FASYNC is configured for a process group (PIDTYPE_PGID), both functions use read_lock(&tasklist_lock) to traverse the task list. However, they are frequently called from softirq context: - send_sigio() via input_inject_event -> kill_fasync - send_sigurg() via tcp_check_urg -> sk_send_sigurg (NET_RX_SOFTIRQ) The deadlock is caused by the rwlock writer fairness mechanism: 1. CPU 0 (process context) holds read_lock(&tasklist_lock) in do_wait(). 2. CPU 1 (process context) attempts write_lock(&tasklist_lock) in fork() or exit() and spins, which blocks all new readers. 3. CPU 0 is interrupted by a softirq (e.g., TCP URG packet reception). 4. The softirq calls send_sigurg() and attempts to acquire read_lock(&tasklist_lock), deadlocking because CPU 1 is waiting. Since PID hashing and do_each_pid_task() traversals are already RCU-protected, the read_lock on tasklist_lock is no longer strictly required for safe traversal. Fix this by replacing tasklist_lock with rcu_read_lock(), aligning the process group signaling path with the single-PID path. This also mitigates a potential remote denial of service vector via TCP URG packets. Lockdep splat: ===================================================== WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [...] Chain exists of: &dev->event_lock --> &f_owner->lock --> tasklist_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(tasklist_lock); local_irq_disable(); lock(&dev->event_lock); lock(&f_owner->lock); <Interrupt> lock(&dev->event_lock); *** DEADLOCK ***

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Locking

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

How developers prevent this class of flaw

  • Use industry standard APIs to implement locking mechanism.

More Improper Locking vulnerabilities (CWE-667)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Locking vulnerabilities

Spotted an error? Tell us.